feat(WARDEN-WP-0021): T1+T2 — scheduled worker tick enabled (systemd --user timer)

T1: systemd --user units (ops-warden-worker.{service,timer}) + scripts/install-worker-timer.sh
(--enable opt-in, cron fallback documented) + examples/worker.env.example. Kill switch:
`systemctl --user disable --now ops-warden-worker.timer` or WORKER_ENABLED=0. Installed and
ENABLED — verified a real systemd run (Result=success, used the llm brain) and the timer is
active (next run +15min).

T2: hardened worker-tick.sh — State Hub /state/health precheck → graceful skip (exit 0) when
unreachable; worker-run failure logged but never fails the unit (retry next tick). Verified
hub-down skip and a live tick.

Conservative tier only; nothing auto-sent. Kill switch is one command.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Enable the scheduled worker tick — conservative inbox triage, unattended"
 domain: infotech
 repo: ops-warden
-status: proposed
+status: active
 owner: claude
 topic_slug: custodian
 planning_priority: high
@@ -57,7 +57,7 @@ the tick already honors that env var.
 
 ```task
 id: WARDEN-WP-0021-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "10451fe6-7fab-4ae0-8494-e6cfdfbcf8cf"
 ```
@@ -73,7 +73,7 @@ state_hub_task_id: "10451fe6-7fab-4ae0-8494-e6cfdfbcf8cf"
 
 ```task
 id: WARDEN-WP-0021-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "1f35f816-1af5-46ff-b48c-1715f3ae5784"
 ```